Security you can
show legal first.
Encryption at rest and in transit, workspace-scoped authorization on every query, audit logs that satisfy compliance, and a documented incident-response process. The boring guarantees enterprise IT actually asks about.
Trust pillars
Six controls. Zero theater.
What we actually do, not what we'd like to put on a slide. Each pillar maps to a specific control in the platform — we'll walk through any of them on a security review call.
Encryption everywhere
TLS 1.2+ in transit. AES-256 at rest for databases, backups, and connector credentials. Keys scoped per installation.
Workspace isolation
Every API request is scoped to a workspace and verified by a guard before touching the database. No cross-tenant queries possible.
Zero plaintext secrets
Connector credentials never leave the server in plaintext. Edit forms show masked placeholders; merges happen server-side.
Least-privilege roles
Owner / admin / member with explicit role transitions. Ownership transfers in a single atomic step.
Tamper-evident audit
Every connector created, every migration launched, every member change recorded with attribution.
Documented incident response
72-hour breach notification commitment. Runbooks for credential rotation, sub-processor compromise, and customer data exposure.
Architecture
Layered controls,
enforced at every hop.
A request from your browser passes through five distinct trust boundaries before it touches the database. Every one is enforced by code in production, not just policy on paper.
- Workspace ID is part of every query — no global lookups.
- Connector secrets pass through an isolated encryption service. Application servers never see the AES key directly.
- Backups are encrypted at rest and aged out within 35 days.
Browser / SDK
TLS 1.2+ from client to edge
JWT auth + workspace guard
Every request scoped before reaching business logic
Service layer
Business logic, rate limiting, audit emit
Encryption service
AES-256 sealing for connector credentials
Postgres + encrypted backups
Workspace-scoped rows · 35-day backup window
Compliance
Frameworks your vendor reviewers expect.
GDPR
LiveEU Standard Contractual Clauses, data-subject rights flow, controller vs processor distinction by data type.
CCPA / CPRA
LiveCalifornia rights honored; explicit "no sale / no share" attestation in the Privacy Policy.
SOC 2 Type II
In progressAnnual audit underway. Available under NDA for evaluation when the first report period closes.
ISO 27001
In progressISMS scoped to the production environment; certification pursuit in flight.
HIPAA-ready
On requestBAA available for enterprise customers handling Protected Health Information.
DPA
On requestStandard Data Processing Addendum executable alongside the MSA. EU-region processing option on enterprise plans.
Need EU data residency?
Enterprise plans support region-pinned processing in the EU. Talk to us about your residency, sub-processor, and audit requirements before signing.
Incident response
If something goes wrong,
you hear from us fast.
We commit to a 72-hour breach notification window — better than what GDPR requires and aligned with what your security and legal teams expect. Here's the runbook we follow.
Detected
0hAnomaly surfaces via automated detection or a vulnerability report to security@univaultport.com.
Contained
< 4hOn-call security engineer scopes the impact, isolates the affected system, and rotates compromised credentials.
Investigated
< 24hRoot cause analysis, log review, identification of affected workspaces. Forensic artifacts preserved.
Notified
< 72hAffected customer admins notified directly. Nature, scope, mitigations, and customer-side actions clearly stated.
Documented
< 14dPublic post-mortem with timeline and remediation; controls updated to prevent recurrence.
Found a vulnerability?
We take responsible disclosure seriously. Email security@univaultport.com with reproduction steps. We acknowledge within one business day and never pursue researchers acting in good faith.
Ship your security review
in days, not quarters.
Enterprise teams get a dedicated security contact, MSA + DPA in advance, and live walk-throughs of the controls described on this page.